From 19468dde1e5c694d0e6203a21fa9d4e315291215 Mon Sep 17 00:00:00 2001 From: "aikido-autofix[bot]" <119856028+aikido-autofix[bot]@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:02:38 +0000 Subject: [PATCH 1/7] fix(security): autofix Overly Broad Permissions in GitHub Actions Workflows is risky --- .github/workflows/deploy.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 1239f0f..2d71572 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -7,10 +7,7 @@ on: repository_dispatch: types: [nightly-release] -permissions: - contents: write - pages: write - id-token: write +permissions: {} concurrency: group: "pages" @@ -19,6 +16,8 @@ concurrency: jobs: build: runs-on: ubuntu-latest + permissions: + contents: write steps: - name: Checkout repository uses: actions/checkout@v7 @@ -66,6 +65,9 @@ jobs: deploy: needs: build runs-on: ubuntu-latest + permissions: + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} From ae7480f620855559f2362fb5d27d83da510e7e6f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:25:11 +0000 Subject: [PATCH 2/7] chore: preconfigure copilot agent environment Co-authored-by: Kvarkas <3611964+Kvarkas@users.noreply.github.com> --- .github/workflows/copilot-setup-steps.yml | 34 +++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/copilot-setup-steps.yml diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml new file mode 100644 index 0000000..29a31c2 --- /dev/null +++ b/.github/workflows/copilot-setup-steps.yml @@ -0,0 +1,34 @@ +name: Copilot Setup Steps + +on: + workflow_dispatch: + push: + paths: + - .github/workflows/copilot-setup-steps.yml + - package.json + - package-lock.json + - .npmrc + pull_request: + paths: + - .github/workflows/copilot-setup-steps.yml + - package.json + - package-lock.json + - .npmrc + +jobs: + copilot-setup-steps: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@v7 + + - name: Setup Node.js + uses: actions/setup-node@v7 + with: + node-version: 26 + cache: npm + + - name: Install dependencies + run: npm ci From 6f902b660336f8b1b468504276efc4d976de36e5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:46:54 +0000 Subject: [PATCH 3/7] fix(workflow): isolate nightly metadata updates to write-scoped job Co-authored-by: Kvarkas <3611964+Kvarkas@users.noreply.github.com> --- .github/workflows/deploy.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 2d71572..9f93474 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -14,7 +14,8 @@ concurrency: cancel-in-progress: false jobs: - build: + update-nightly-metadata: + if: github.event_name == 'repository_dispatch' runs-on: ubuntu-latest permissions: contents: write @@ -51,6 +52,23 @@ jobs: git commit -m "Update nightly download to v${RELEASE_VERSION} NB ${RELEASE_BUILD}" git push origin HEAD:svelteKit + build: + needs: update-nightly-metadata + if: ${{ always() && (github.event_name != 'repository_dispatch' || needs.update-nightly-metadata.result == 'success') }} + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + ref: ${{ github.ref_name }} + + - name: Setup Node.js + uses: actions/setup-node@v7 + with: + node-version: 26 + - name: Install dependencies run: npm ci From eb98eac201a05ab7853e00c7790ac97f2788bb95 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:47:29 +0000 Subject: [PATCH 4/7] fix(workflow): harden checkout refs and build gating Co-authored-by: Kvarkas <3611964+Kvarkas@users.noreply.github.com> --- .github/workflows/deploy.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 9f93474..c987095 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -22,6 +22,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v7 + with: + ref: svelteKit - name: Setup Node.js uses: actions/setup-node@v7 @@ -54,7 +56,7 @@ jobs: build: needs: update-nightly-metadata - if: ${{ always() && (github.event_name != 'repository_dispatch' || needs.update-nightly-metadata.result == 'success') }} + if: ${{ always() && (github.event_name != 'repository_dispatch' || contains(fromJson('["success","skipped"]'), needs.update-nightly-metadata.result)) }} runs-on: ubuntu-latest permissions: contents: read @@ -62,7 +64,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 with: - ref: ${{ github.ref_name }} + ref: svelteKit - name: Setup Node.js uses: actions/setup-node@v7 From ac4e422dca041d6bd4014006840239fec791ea5a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:48:01 +0000 Subject: [PATCH 5/7] fix(workflow): split dispatch and non-dispatch build jobs Co-authored-by: Kvarkas <3611964+Kvarkas@users.noreply.github.com> --- .github/workflows/deploy.yml | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index c987095..b9d8c4c 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -54,9 +54,36 @@ jobs: git commit -m "Update nightly download to v${RELEASE_VERSION} NB ${RELEASE_BUILD}" git push origin HEAD:svelteKit - build: + build-nightly: needs: update-nightly-metadata - if: ${{ always() && (github.event_name != 'repository_dispatch' || contains(fromJson('["success","skipped"]'), needs.update-nightly-metadata.result)) }} + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + ref: svelteKit + + - name: Setup Node.js + uses: actions/setup-node@v7 + with: + node-version: 26 + + - name: Install dependencies + run: npm ci + + - name: Build the SvelteKit site + run: npm run build + + - name: Upload artifact + uses: actions/upload-pages-artifact@v5 + with: + path: build/ + + build: + if: github.event_name != 'repository_dispatch' runs-on: ubuntu-latest permissions: contents: read @@ -83,7 +110,8 @@ jobs: path: build/ deploy: - needs: build + needs: [build, build-nightly] + if: ${{ always() && (needs.build.result == 'success' || needs.build-nightly.result == 'success') }} runs-on: ubuntu-latest permissions: pages: write From b2aaf11e5910b10f17d68506b8e7111f5b46d5a6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:48:39 +0000 Subject: [PATCH 6/7] fix(workflow): separate deploy paths by event type Co-authored-by: Kvarkas <3611964+Kvarkas@users.noreply.github.com> --- .github/workflows/deploy.yml | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index b9d8c4c..df53124 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -109,9 +109,24 @@ jobs: with: path: build/ + deploy-nightly: + needs: build-nightly + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + permissions: + pages: write + id-token: write + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + steps: + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@v5 + deploy: - needs: [build, build-nightly] - if: ${{ always() && (needs.build.result == 'success' || needs.build-nightly.result == 'success') }} + needs: build + if: github.event_name != 'repository_dispatch' runs-on: ubuntu-latest permissions: pages: write From 5ba8e460bbc90684d1b1b7f402a08b0a11b4e60c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:49:07 +0000 Subject: [PATCH 7/7] fix(workflow): build non-dispatch events from trigger ref Co-authored-by: Kvarkas <3611964+Kvarkas@users.noreply.github.com> --- .github/workflows/deploy.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index df53124..0852065 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -22,8 +22,6 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v7 - with: - ref: svelteKit - name: Setup Node.js uses: actions/setup-node@v7